Page Comparison

Shib-Session-ID

• wiki.shibboleth.net

persistent-id or uniqueID

• wiki.shibboleth.net
• DFN AAI
• bwIDM

eduPersonPrincipalName or

eppn or EPPN

• internet2.edu
• bwIDM

mail or email

 Email address(es) of user. Multiple mail address should be separated by

; (semicolon). Matches existing PowerFolder accounts unless turned off in config:

shibboleth.accounts.match_email=false

• bwIDM

givenName

• bwIDM

surname or sn

• bwIDM

o or organizationName

Account.organization and

Account.custom2 (if unmapped)

Organization (name) of user.

Auto-creates organizations within PowerFolder unless turned off in config:

shibboleth.create.organizations=false

Organization attribute name can be alternated by config:

shibboleth.organizations.attribute=customOrgAttrib

• bwIDM

affiliation or

eduPersonScopedAffiliation

• bwIDM

Free mapping field. Not mapped by default. Use configuration entry to set mapping

Available since 10.5

Free mapping field. Not mapped by default. Use configuration entry to set mapping

Available since 10.5

Free mapping field. Not mapped by default. Use configuration entry to set mapping

Available since 10.5. Format: ISO 8601 or Unix timestamp or yyyyMMddHHmmss

• 2016-12-23T13:37:69.107Z

• 20161231133769

entitlement or

eduPersonEntitlement

Must match the entitlement value if set in PowerFolder config:

shibboleth.entitlement=http://example.entitlement

(by default no entitlement value is set, which means disabled entitlement check)

The entitlement attribute is optional and should only be set, if it's sent/used by the IdP.

• bwIDM

scopedUsername or

bwScopedUsername

Persistent, external, unique username for retrieving an existing account

Not longer mapped by default since 10.5. To remap use attribute configuration